Loading vulnerability…
GitLab EE Guest Security Policy YAML Disclosure
CVE-2024-10925 is an improper authorization check in GitLab Enterprise Edition that allows a user with the Guest role to read Security policy YAML. It affects GitLab EE versions from 16.2 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A Guest user can access Security policy YAML that should not be available to that role, resulting in unauthorized disclosure of security-policy information.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by tightly limiting assignment of the Guest role, reviewing project and group membership for unnecessary low-privilege access, and restricting access to projects or namespaces containing sensitive security policy definitions. Monitor access patterns involving security policy resources and review authorization boundaries around policy management features until the upgrade can be completed. No specific vendor-provided workaround is available in the provided information.
Patch, then assume compromise.
Upgrade GitLab EE to version 17.7.6, 17.8.4, 17.9.1, or a later supported release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.